# CVEs published 2023-03-20

61 CVEs were published on March 20, 2023: 3 critical, 13 high. Days are UTC.

- [CVE-2012-10009](https://cve.now/CVE-2012-10009.md): 404like Plugin 404Like.php checkPage sql injection (CVSS 7.3, 404like Plugin)
- [CVE-2022-43663](https://cve.now/CVE-2022-43663.md): An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. (CVSS 8.1, WellinTech KingHistorian)
- [CVE-2022-45124](https://cve.now/CVE-2022-45124.md): An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. (CVSS 7.5, WellinTech KingHistorian)
- [CVE-2023-28425](https://cve.now/CVE-2023-28425.md): Specially crafted MSETNX command can lead to denial-of-service (CVSS 5.5, redis)
- [CVE-2023-27578](https://cve.now/CVE-2023-27578.md): Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check (CVSS 9.1, galaxyproject galaxy)
- [CVE-2023-0681](https://cve.now/CVE-2023-0681.md): Rapid7 Nexpose Uncontrolled URL Redirect (CVSS 4.3, Rapid7 Nexpose)
- [CVE-2023-0911](https://cve.now/CVE-2023-0911.md): Shortcodes Ultimate \< 5.12.8 - Subscriber+ User Meta Disclosure (CVSS 6.5, WordPress Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2023-0340](https://cve.now/CVE-2023-0340.md): Custom Content Shortcode \<= 4.0.2 - Contributor+ LFI (CVSS 8.8, Custom Content Shortcode)
- [CVE-2023-0875](https://cve.now/CVE-2023-0875.md): WP Meta SEO \< 4.5.3 - Subscriber+ SQLi (CVSS 8.8, WP Meta SEO)
- [CVE-2023-0273](https://cve.now/CVE-2023-0273.md): Custom Content Shortcode \<= 4.0.2 - Contributor+ Stored XSS (CVSS 5.4, Custom Content Shortcode)
- [CVE-2022-4148](https://cve.now/CVE-2022-4148.md): WP OAuth Server \< 4.3.0 - Subscriber+ Arbitrary Client Deletion (CVSS 4.3, WP OAuth Server)
- [CVE-2023-0370](https://cve.now/CVE-2023-0370.md): WPB Advanced FAQ \<= 1.0.6 - Contributor+ Stored XSS (CVSS 5.4, WPB Advanced FAQ)
- [CVE-2023-0937](https://cve.now/CVE-2023-0937.md): VK All in One Expansion Unit \< 9.87.1.0 - Reflected XSS (CVSS 6.1, VK All in One Expansion Unit)
- [CVE-2023-0167](https://cve.now/CVE-2023-0167.md): GetResponse for WordPress \<= 5.5.31 - Contributor+ Stored XSS (CVSS 5.4, GetResponse for WordPress)
- [CVE-2023-0940](https://cve.now/CVE-2023-0940.md): ProfileGrid \< 5.3.1 - Subscriber+ Arbitrary Password Reset (CVSS 8.8, ProfileGrid)
- [CVE-2023-0890](https://cve.now/CVE-2023-0890.md): Shortcodes Ultimate \< 5.12.8 - Subscriber+ Arbitrary Post Access (no CVSS, WordPress Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2023-0865](https://cve.now/CVE-2023-0865.md): WooCommerce Multiple Customer Addresses & Shipping \< 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR (no CVSS, WooCommerce Multiple Customer Addresses & Shipping)
- [CVE-2023-0364](https://cve.now/CVE-2023-0364.md): real.Kit \< 5.1.1 - Contributor+ Stored XSS (no CVSS, real.Kit)
- [CVE-2023-0630](https://cve.now/CVE-2023-0630.md): Slimstat Analytics \< 4.9.3.3 - Subscriber+ SQL Injection (no CVSS, Slimstat Analytics)
- [CVE-2023-0145](https://cve.now/CVE-2023-0145.md): Saan World Clock \<= 1.8 - Contributor+ Stored XSS (no CVSS, Saan World Clock)
- [CVE-2023-0369](https://cve.now/CVE-2023-0369.md): GoToWP \<= 5.1.1 - Contributor+ Stored XSS (no CVSS, GoToWP)
- [CVE-2023-0631](https://cve.now/CVE-2023-0631.md): Paid Memberships Pro \< 2.9.12 - Subscriber+ SQL Injection (no CVSS, Paid Memberships Pro)
- [CVE-2023-0365](https://cve.now/CVE-2023-0365.md): React Webcam \<= 1.2.0 - Contributor+ Stored XSS (no CVSS, React Webcam)
- [CVE-2023-0175](https://cve.now/CVE-2023-0175.md): Smart Logo Showcase Lite \<= 1.1.9 - Contributor+ Stored XSS (CVSS 5.4, Responsive Clients Logo Gallery Plugin for WordPress)
- [CVE-2023-0876](https://cve.now/CVE-2023-0876.md): WP Meta SEO \< 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect (CVSS 6.1, WP Meta SEO)
- [CVE-2022-3894](https://cve.now/CVE-2022-3894.md): WP OAuth Server \< 4.2.5 - Arbitrary Post Deletion via CSRF (CVSS 4.3, WP OAuth Server)
- [CVE-2023-22288](https://cve.now/CVE-2023-22288.md): Email HTML Injection (CVSS 6.8, Tribe29 Checkmk)
- [CVE-2023-27586](https://cve.now/CVE-2023-27586.md): CairoSVG improperly processes SVG files loaded from external resources (CVSS 9.9, Kozea CairoSVG · cairosvg)
- [CVE-2023-28429](https://cve.now/CVE-2023-28429.md): Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field (CVSS 6.1, pimcore · pimcore/pimcore)
- [CVE-2023-28428](https://cve.now/CVE-2023-28428.md): PDFio vulnerable to Denial Of Service when opening a corrupt PDF file (CVSS 6.2, michaelrsweet pdfio)
- [CVE-2023-28424](https://cve.now/CVE-2023-28424.md): Soko SQL Injection vulnerability (CVSS 9.1, gentoo soko)
- [CVE-2023-28118](https://cve.now/CVE-2023-28118.md): kaml has potential denial of service while parsing input with anchors and aliases (CVSS 7.5, charleskorn kaml · com.charleskorn.kaml:kaml)
- [CVE-2023-28083](https://cve.now/CVE-2023-28083.md): Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). (CVSS 8.3, HPE Integrated Lights-Out)
- [CVE-2023-26513](https://cve.now/CVE-2023-26513.md): Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS (CVSS 7.5, Apache Software Foundation Apache Sling Resource Merger · o…)
- [CVE-2023-0320](https://cve.now/CVE-2023-0320.md): XSS in UBYS (CVSS 5.4, Izmir Katip Celebi University UBYS)
- [CVE-2022-47591](https://cve.now/CVE-2022-47591.md): WordPress Map Multi Marker Plugin \<= 3.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Mickael Austoni Map Multi Marker)
- [CVE-2022-47592](https://cve.now/CVE-2022-47592.md): WordPress MagicForm Plugin \<= 0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Dmytriy.cooperman MagicForm)
- [CVE-2023-22682](https://cve.now/CVE-2023-22682.md): WordPress Camera slideshow Plugin \<= 1.4.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Manuel Masia | Pixedelic.com Camera slideshow)
- [CVE-2023-22680](https://cve.now/CVE-2023-22680.md): WordPress No API Amazon Affiliate Plugin \<= 4.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Altanic No API Amazon Affiliate)
- [CVE-2023-22679](https://cve.now/CVE-2023-22679.md): WordPress WP Better Emails Plugin \<= 0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Nicolas Lemoine WP Better Emails)
- [CVE-2023-23721](https://cve.now/CVE-2023-23721.md): WordPress Admin Log Plugin \<= 1.50 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, David Gwyer Admin Log)
- [CVE-2023-23718](https://cve.now/CVE-2023-23718.md): WordPress Page Loading Effects Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Esstat17 Page Loading Effects)
- [CVE-2023-22678](https://cve.now/CVE-2023-22678.md): WordPress Superior FAQ Plugin \<= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Rafael Dery Superior FAQ)
- [CVE-2023-22681](https://cve.now/CVE-2023-22681.md): WordPress Online Exam Software : eExamhall Plugin \<= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Aarvanshinfotech Online Exam Software : eExamhall)
- [CVE-2023-24381](https://cve.now/CVE-2023-24381.md): WordPress Advanced Social Pixel Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NsThemes Advanced Social Pixel)
- [CVE-2023-25064](https://cve.now/CVE-2023-25064.md): WordPress WP htpasswd Plugin \<= 1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Matteo Candura WP htpasswd)
- [CVE-2023-25794](https://cve.now/CVE-2023-25794.md): WordPress Nooz Plugin \<= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Mighty Digital Nooz)
- [CVE-2023-25795](https://cve.now/CVE-2023-25795.md): WordPress Feed Changer Plugin \<= 0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP-master.ir Feed Changer & Remover)
- [CVE-2023-1507](https://cve.now/CVE-2023-1507.md): SourceCodester E-Commerce System Category Name controller.php cross site scripting (CVSS 3.5, SourceCodester E-Commerce System)
- [CVE-2023-25782](https://cve.now/CVE-2023-25782.md): WordPress Service Area Postcode Checker Plugin \<= 2.0.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Second2none Service Area Postcode Checker)
- [CVE-2023-1506](https://cve.now/CVE-2023-1506.md): SourceCodester E-Commerce System login.php sql injection (CVSS 5.6, SourceCodester E-Commerce System)
- [CVE-2023-1505](https://cve.now/CVE-2023-1505.md): SourceCodester E-Commerce System setDiscount.php sql injection (CVSS 5.0, SourceCodester E-Commerce System)
- [CVE-2023-1504](https://cve.now/CVE-2023-1504.md): SourceCodester Alphaware Simple E-Commerce System sql injection (CVSS 5.6, SourceCodester Alphaware Simple E-Commerce System)
- [CVE-2023-1250](https://cve.now/CVE-2023-1250.md): Code execution through ACL creation (CVSS 7.4, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-1248](https://cve.now/CVE-2023-1248.md): Possible XSS in Ticket Actions (CVSS 6.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-1503](https://cve.now/CVE-2023-1503.md): SourceCodester Alphaware Simple E-Commerce System admin\_index.php sql injection (CVSS 5.6, SourceCodester Alphaware Simple E-Commerce System)
- [CVE-2023-1502](https://cve.now/CVE-2023-1502.md): SourceCodester Alphaware Simple E-Commerce System edit\_customer.php sql injection (CVSS 5.6, SourceCodester Alphaware Simple E-Commerce System)
- [CVE-2022-4933](https://cve.now/CVE-2022-4933.md): ATM Consulting dolibarr\_module\_quicksupplierprice interface.php upatePrice sql injection (CVSS 6.3, ATM Consulting dolibarr\_module\_quicksupplierprice)
- [CVE-2015-10096](https://cve.now/CVE-2015-10096.md): Zarthus IRC Twitter Announcer Bot twitter\_announcer.rb get\_tweets command injection (CVSS 5.0, Zarthus IRC Twitter Announcer Bot)
- [CVE-2023-1515](https://cve.now/CVE-2023-1515.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2, pimcore/pimcore)
- [CVE-2023-1517](https://cve.now/CVE-2023-1517.md): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (CVSS 4.0, pimcore/pimcore)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.